Find All fieldnames for fields which contain a specified value

[essklau]

Hello,

My question is whether or not I can, via sp, return a list of all fieldnames which contain a specified value.

For instance, if I was looking for "superstar", can I construct a search which will return all fields which contain "superstar" as a value?

Thanks

[martin_mueller]

Sure. With splunkd being our superstar, you can do this:

index=_internal | fields - tag::*
| foreach * [eval fieldnames = if(<<FIELD>>=="splunkd", mvappend(fieldnames, "<<FIELD>>"), fieldnames)]
| stats values(fieldnames)

For me that yields series (from metrics logs) and sourcetype (obvious).